MDaemon Email Server 22.0.0 through 26.0.3 ships an old ClamAV library that a crafted RAR attachment can abuse. ESET reports that attackers used it in Ukraine to plant backdoors on mail servers, with no one opening the email. Run MDaemon 26.0.4 or later, or replace the ClamAV files by hand.
The vulnerability is CVE-2025-8088, a WinRAR path traversal bug from 2025. Our CVE-2025-8088 vulnerability page covers the WinRAR side; this post is for MDaemon administrators.
Which MDaemon Servers Need the Fix?
The MDaemon critical update MD090126 lists all supported versions from 22.0.0 through 26.0.3 as affected, and adds that older, unsupported versions are affected too. MDaemon says no action is needed by customers who do not use, and do not plan to use, the MDaemon AntiVirus licensed feature.
| MDaemon version | Status per MDaemon | What to do |
|---|---|---|
| Older than 22.0.0. | Affected and out of support. | Renew the licence and move to a supported version. |
| 22.0.0 to 26.0.3. | Affected. | Upgrade to 26.0.4 or later, or patch ClamAV by hand. |
| 26.0.4 or later. | Includes the updated ClamAV library. | Confirm the version on every server. |
The current MDaemon release notes show version 26.5.0, dated 20 October 2026. That release updates ClamAV to 1.4.6 and the Content Filter’s unrar64.dll to 7.23.
How ESET Says a Single Email Reached the Scanner
ESET describes the attack in its APT Activity Report for April to September 2026, published on 28 October. MDaemon uses ClamAV to scan attachments on incoming mail, and ESET says MDaemon kept shipping an old libclamunrar.dll after ClamAV had fixed the bug.
According to ESET, the attackers only had to send an email with a crafted RAR file to any address on a vulnerable server. ClamAV opened the archive to scan it, and the exploit wrote a malicious DLL to the server’s disk. Because no one had to open anything, ESET notes, the attackers did not bother with a convincing lure.
That changes the risk: NVD scores CVE-2025-8088 at 8.8 with user interaction required, because in WinRAR a person opens the archive. In MDaemon, the scanner does that step, which is our reading of ESET’s account and not a new score from NVD or MDaemon.
- Exploited through MDaemonYesESET reports an active campaign against mail servers in Ukraine28 Oct 2026
- CISA KEVYesListed since 12 Aug 2025 for RARLAB WinRAR, with known ransomware use30 Oct 2026
- Public exploit codeYesPoC and exploit tools for WinRAR on GitHub since 12 Aug 2025; 30 repositories name the CVE, some of them detection tools31 Oct 2026
- Posts on XYesESET Research posted the MDaemon finding; two more accounts repeated it31 Oct 2026
- Brandefense BlackholeYesFour Telegram posts since 15 Oct, all reposting published articles31 Oct 2026
ESET Research also summed the finding up in a post on X on 30 October. The post names two backdoors, delivered “with no user interaction required.”
What the Attackers Left Behind
ESET says the attackers used two malware families, HELLAGE and HELLTAG, names it credits to CERT-UA. HELLAGE is a backdoor that steals email messages and other data, talks to a hardcoded command server and can install more malware. HELLTAG takes commands through a hardcoded Telegram bot, which lets it run commands, move files and survey the system.
ESET describes the actors as Russia-aligned, but says it cannot yet tie the campaign to any known group. ESET places the campaign in Ukraine. Mail servers have been targets before: see our Zimbra webmail exploitation case, a separate campaign.
Do This Now on Every MDaemon Server
- Check the versionAnything from 22.0.0 to 26.0.3, or older, needs the fix.
- Check MDaemon AntiVirusMDaemon says servers without this licensed feature need no action.
- Upgrade to 26.0.4 or laterThis release carries the updated ClamAV library.
- Patch ClamAV if you cannot upgradeInstall ClamAV 1.4.6 LTS files into the ClamAVPlugin folder.
- Look for signs of a hitReview new DLL files on the server and traffic to Telegram from it.
For the manual route, MDaemon says to get ClamAV 1.4.6 LTS from the ClamAV downloads page. Then copy its EXE and DLL files over those in MDaemon\SecurityPlus\ClamAVPlugin\.
The last step is our suggestion, built on ESET’s account of a DLL written to disk and a Telegram bot. If you find either sign, treat the mail on that server as exposed, since ESET says HELLAGE steals email messages.